The invention relates to an electronic control system for a safety device of a motor vehicle, having a first sensor for a motion quantity, a computer for converting the motion quantity to a triggering signal for the safety device, and a second sensor for checking the plausibility of the sensor signal supplied by the first sensor.
Such a control system is known from German Patent document DE 196 25 058 A. For achieving an output signal that is as faultless as possible for a rotation rate to be determined, the two sensors operate according to different measuring principles. In this case, a combination of two mutually independent measuring systems is carried out, the combination taking place such that the disadvantages of the individual systems are to disappear and the advantages of the individual systems are to be utilized. The output signals of both sensor systems are linked with one another, the linking taking place in corresponding signal evaluation devices, which are constructed, for example, as a microprocessor.
For improving the system reliability, it is also known to use a diversified redundancy. For example, for an airbag control system, this applies to a plurality of external sensors which are also based on physically different operating principles. Thus, for example, door pressure sensors are installed in the doors and determine a volume change of the interior door volume caused by a crash. In addition, the forces acting upon the vehicle are detected by use of acceleration sensors (such as upfront sensors in the front section, B or C column “satellite” sensors, etc.). In addition, these sensors, by which, when needed, (for example, in the event of a crash), a clear triggering decision has to be detectable, have very high quality and availability requirements.
In order to meet these very high requirements, currently high-expenditure self-diagnoses and diagnoses within the control system are being carried out for sensors. However, these are primarily used for discovering faults and failures in the operation of the system (such as accidental hardware failures of electrical components). In addition, a triggering decision/functional decision, for safety reasons, is always checked for plausibility while including redundant data.
In order to be able to judge the confidence level of the data/signal quantity, additional sensors are used in the control device as reference sensors for checking the plausibility of the “event”. Sensors of identical constructions can also be used for this purpose.
Although, when redundant sensors are used, the influence of individual faults can be reduced, common as well as identical, particularly systematic, faults exercise a dominant influence. Such faults are called Common Cause Failure (=CCF, also called “Common Mode Failure”), i.e. faults of a common cause. One example are components which, for safety reasons, simultaneously work on the same object several times and fail at the same time (all 4 brakes fail simultaneously).
Particularly in the field of chassis sensors for an acceleration in the low-G range (0 g to 5 g) and for the detection of rotation rates, it is found to be difficult to achieve safety with respect to common cause failure (CCF) by way of diversified redundancy, for example, in the form of diversified sensors.
Because of the lack of diversified redundancy, particularly the dominant common cause failures (CCFs) of sensors, CCFs on the transmission route from the sensor to a signal read-in device, CCFs in this device, CCFs on the transmission route to a signal evaluation device, as well as CCFs in the evaluation device, cannot be detected.
It is an object of the invention to create an electronic control system of the above-mentioned type which provides a maximum amount of operating safety at low expenditures.
According to the invention, an electronic control system is provided for a safety device of a motor vehicle, having a first sensor for a motion quantity, a computer for converting the motion quantity to a triggering signal for the safety device, and a second sensor for checking the plausibility of the sensor signal supplied by the first sensor. The two sensors are arranged with an identical construction and/or effect and at an at least approximately identical location on a printed circuit board such that, in a proper operating mode, their output signals have different preceding signs and are identical with respect to their amounts (same absolute value) over the entire operating range.
In addition to the uniformity of construction and operation of the two sensors, the arrangement at an approximately identical location on a printed circuit board and its orientation are of decisive significance.
In the proper operating mode, the two sensor output signals therefore have different preceding signs and are identical with respect to their amount (same absolute value) over the entire operating range.
The arrangement of the two sensors according to the invention differs from sensors of the same construction and effect, which are arranged in a mutually spatially separate manner, by their signal curve. The spatial separation leads to a different dynamic signal curve at the individual sensors, caused by a different mechanical coupling of the sensors, for example, a different vibration behavior (especially amplitude differences, phase shifts, and different resonance frequencies). Specifically, in the automotive area in control devices, a different vibration behavior is observed even if sensors are positioned on the same printed circuit board. The different mechanical coupling is mainly the result of the different distance from the fastening points. In contrast, in the case of the arrangement according to the invention, the two signal curves have different preceding signs and are identical in their amounts (absolute values). As a result, CCF phenomena can be avoided.
Advantageous embodiments of the invention which apply to a rotation rate sensor, an acceleration sensor or a combined acceleration/rotation rate sensor are further described herein.
Other objects, advantages and novel features of the present invention will become apparent from the following detailed description of one or more preferred embodiments when considered in conjunction with the accompanying drawings.